Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06-01-2024 10:18
General
-
Target
45de70c85ece8763c685808eea085df4.exe
-
Size
669KB
-
MD5
45de70c85ece8763c685808eea085df4
-
SHA1
c9dd5313a661fd17b154ccb17a36e8399fc933a5
-
SHA256
d595339cbbf415eca195eb3a0d9a8b6c9ff82a0cf36e4e867f5cef24503bb532
-
SHA512
03a1d922711db1afc0a512151371c9a97a7478578c11591109537b1427aeac8b3ac44aa52c83439afe56e20134fd888bcaee1632f6046ce8edf0d99622fb362d
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DNKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWgKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Renames multiple (188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45de70c85ece8763c685808eea085df4.exe"C:\Users\Admin\AppData\Local\Temp\45de70c85ece8763c685808eea085df4.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5554d996e3d80a958a675bfbae6a5d9f7
SHA1a6634399f55941844eeddd2f37861cc911098dec
SHA2561d4631cac5e7f2b94ae8bc4fec304db5d1a648861e46754fa6fe063b1aa35071
SHA512ff1d4ce5e18f64ba8c81d2ebfcc0b7689ec739e2522199d6f4c708d0174f5d10b0a9524307f19054229401b67732099e764fc22eb21dad11abeec0993f4397f5
-
Filesize
348KB
MD59ef25437156e94a677ef32c022b9931f
SHA18a35d05a8c0436f080f7c03e0e13b9b4793e1f86
SHA256bc281ea5178fef9db029dd90ee9a3b0da2b3ea4f6d3dcc5f951ea8ef5f3ebee3
SHA512138b8a6b1d4e4a351357464e124304ac7dc1c8ecb927e762675861442193263dfa61c97c5b9d3a853b08f4a60e2392f67d1a4136720635f3c7b3017e3a979dff
-
Filesize
536B
MD5f04f89c55e9ffa459ea434741ce586d0
SHA19ab734eb71b6176006cdf20887c0eac79c5059fb
SHA25614129ad776df6cccba70025005ffc73ec40496bec86491eab2c3435c6c7cf93b
SHA512e3dbfe1058f0ebc3b40097cdea4ee20950495c28ee11e45960e2f013d2bc5bd3577261603a94dec3a45e0d5b51b6c182a4823c7380c9c2d00206c518996be5bb
-
Filesize
5KB
MD5ed45448c8877c80a7dd08869ed961512
SHA16a6566e40c808628bcccb69a4f0ee753d79e4f09
SHA2563e16ceb8048cef9ec0fe7b26c35e7d64fa4acaaf6c0ce0b9d7bec10f9ea67c61
SHA512f2a263d834b24c0801e6ff46d9afa8c9094e7006a60a29da5e68a5ce9d7bf47d827b5a60b12782bb56302d8fb00e6ef8b4783fbb52510c0ca776a4e5536c7b4c